Draw a Time Chart where the x-axis is time.
Time is grouped into buckets.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
buckets | number | false | Defines the number of buckets. The time span is defined by splitting the query time interval into this many buckets. | |
| Minimum | 0 | |||
| Maximum | 1500 | |||
function | [Aggregate] | false | Specifies which aggregate functions to perform on each group. Default is to count the elements in each group. | |
limit | number | false | 10 | Defines the maximum number of series to produce. A warning is produced if this limit is exceeded, unless the parameter is specified explicitly. |
| Maximum | 500 | |||
minSpan | string | false | auto | Defines the time span for each bucket. The time span is defined as a relative-time-synxtax such as 1hour or 3 weeks. If not provided or set to auto, the search time interval —and thus the number of buckets— is determined dynamically. |
| Valid Values | 1day | Timespan set using Relative Time Syntax | ||
| auto | Automatically determine the time span for each bucket | |||
series | string | false | Each value in the field specified by this parameter becomes a series on the graph. [a] | |
span | string | false | auto | Defines the time span for each bucket. The time span is defined as a relative-time-synxtax like 1hour or 3 weeks. If not provided or set to auto, the search time interval —and thus the number of buckets— is determined dynamically. |
timezone | string | false | Defines the time zone for bucketing. This value overrides timeZoneOffsetMinutes which may be passed in the HTTP/JSON query API. For example: timezone=UTC or timezone='+02:00'. | |
unit | string | false | Each value is a unit conversion for the given column. For instance: bytes/span to Kbytes/day converts a sum of bytes into Kb/day automatically taking the time span into account. If present, this array must be either length 1 (apply to all series) or have the same length as the function parameter. Default is no conversion. See the reference at Relative Time Syntax. | |
Examples
Show the number of different http methods over time. This is done by dividing events into time buckets of 1 minute. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method
timechart(span=1min, series=method, function=count())Show the number of different http methods over time. This is done by dividing events into 1000 buckets. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method
timechart(buckets=1000, series=method, function=count())Graph response time percentiles
timechart(function=percentile(field=responsetime, percentiles=[50, 75, 90, 99, 99.9]))
We use coda hale metrics to print rates of various events once per
minute. Such lines include 1-minute average rates
m1=N where
N is some number. This example
displays all such meters (which are identified by the field
name), converting the rates from
events/sec to Ki/day.
type=METER rate_unit=events/second | timechart(name, function=avg(m1), unit="events/sec to Ki/day", span=5m)Upon completion of every humio request, we issue a log entry which (among other things) prints the size=N of the result. When summing such size's you would need to be aware of the span, but using a unit conversion, we can display the number in Mbytes/hour, and the graph will be agnostic to the span.
timechart(function=sum(size), unit="bytes/bucket to Mbytes/hour", span=30m)